topic Re: LDAP Import of nested groups in Alfresco Archive

LDAP Import of nested groups

cnihill — Thu, 25 Mar 2010 11:31:41 GMT

Hi,I am looking to import a master group to Alfresco using an LDAP query. The master group contains 4 groups, one of which contains 17 other groups.At the moment, when I run this query to import the master group, the four groups get imported but the 17 sub groups of one of those groups do not.The on

Re: LDAP Import of nested groups

dward — Thu, 25 Mar 2010 12:17:09 GMT

Yes, LDAP import of hierarchical group structures is possible, but not if you restrict your LDAP queries like this!

In Active Directory, the memberOf attribute it not recursive - it only lists the groups that a group or user is a direct member of.

So you are going to have to find another way to restrict your user and group queries. If "Alfresco Master Group" really is the set of all groups that should be displayed in Alfresco, then perhaps you could directly add all groups and users that you want to show up to this group? Within this group, you could still have nested structures. All the inter-relationships between groups will still be picked up.

Re: LDAP Import of nested groups

cnihill — Thu, 25 Mar 2010 15:40:04 GMT

Thanks for the help.

Can I just confirm what you are saying?

You say that if I place all the groups I need, directly under the Alfresco Master Group, it should work?
I would agree with this based on what i have seen so far.

The way it stands at the moment is, I import the Alfresco Master Group and those groups directly inside that group get populated with users.
The groups within the Alfresco Master Group that conatin sub groups do not get populated with those subgroups which is due to the fact that you say memberOf is not recursive.

Is there any other way around adding all groups directly under the Master Group? Changing the AD directory structure might not be feasible.
Can the query be edited to recrsively go through the groups?

Re: LDAP Import of nested groups

brazen — Fri, 11 Mar 2011 21:29:51 GMT

Change your query to this:

    ##groupQuery
    ##Inserting the master group here
    ldap.synchronization.groupQuery=(&(objectclass\=group)(memberOf:1.2.840.113556.1.4.1941:\=CN=Alfresco Master Group,OU=User Groups,OU=ICTL,OU=Master Groups,DC=Domain,DC=ie))

    ##differential Group Query
    ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(memberOf:1.2.840.113556.1.4.1941:\=CN=Alfresco Master Group,OU=User Groups,OU=ICTL,OU=Master Groups,DC=Domain,DC=ie))
‍‍‍‍‍‍‍

Notice the :1.2.840.113556.1.4.1941: added in after the memberOf in each query. This is the LDAP_MATCHING_RULE_IN_CHAIN modifier - http://msdn.microsoft.com/en-us/library/aa746475%28v=vs.85%29.aspx